Submit a ticketCall us

Solarwinds & Cisco Live! Barcelona
Join us from the 29th of January to the 2nd of February at Cisco Live 2018 in Barcelona, where we will continue to show how monitoring the network with SolarWinds will keep you ahead of the game. At our booth (WEP 1A), we will demonstrate how SolarWinds network solutions can help. As a bonus, we are also hosting a pre-event webinar - Blame the Network, Hybrid IT Edition with our SolarWinds Head Geek™, Patrick Hubbard on January 24th - GMT (UTC+0): 10:00 a.m. to 11:00 a.m. There's still time to RSVP.

Home > Success Center > Netflow Traffic Analyzer (NTA) > The NPM interface charts are showing less bandwidth utilization than the Netflow charts

The NPM interface charts are showing less bandwidth utilization than the Netflow charts

Table of contents


Cases are generated due to Netflow charts showing less bandwidth utilization than NPM interface charts. 

There are several reasons this can happen.  This can be due to device configuration or application setting being disabled.

Depending on the make and model of the device it can make a difference on the troubleshooting steps to take.


  • All NTA versions
  • This can happen with multiple vendors 


1. Identify the make and the model of the device and see if 

If it's a Cisco 6500 series, see the configuration of the device. 

  1. Correctly identify the make and model of the device
    • If the device is a Cisco 6500 series first thing to look at is the configuration of the device.  Device configuration is usually the problem with this device.  The following command is usually missing “ip flow ingress layer2-switched vlan xxxx” which will cause switched layer 3 traffic not to be captured (compare customer device configuration with the following document .
  2. If device is something other than Cisco 6500 proceed with the following steps
  3. Verify the following command is configured
    • “ip flow-cache timeout active 1”  This will ensure that all cached flow data is exported every 1 minute.  By default long lived packed are exported every 30 minutes and could cause some spikes and a delay in data that will not show actual utilization during the same time as NPM.
  4. Check the NTA setting page and see if the following settings are enabled or disabled "Allow monitoring of flows from unmanaged interfaces" & "Enable Data retention for traffic on unmonitored ports".  When these are disabled they can cause flows to be dropped.
    1. NOTE: When this setting is disabled ""Allow monitoring of flows from unmanaged interfaces"  if both interfaces in the flow packet are not being managed in NPM the entire flow will be dropped
      • If packets are being dropped this can also be verified by checking the Netflow performance counters to see if the counters are increasing.
  5. If all the items mentioned above are set correctly perform a Wireshark capture and verify all required fields are properly populated.
    • Netflow required fields to gather full information  If some of the required fields are missing the entire flow will be dropped.   (NOTE: If interface if index values are zeros (0) data will not be captured in that direction. Also if only ingress or egress data is provided customer will be missing data in the Ingress or Egress direction)
      • SNMP Input interface ifindex value
      • SNMP Output interface ifindex value
      • Ingress bytes
      • Ingress packets
      • Protocol
      • Source UDT/TCP ports
      • Destination UDT/TCP ports
      • Source IP Address
      • Destination IP Address
      • Optional are IP ToS and AS value



Last modified